Third-Party Access Agreement Checklist
List what to cover when giving suppliers access.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Create a checklist for agreements with suppliers who access our systems or data. Type of supplier and access: [SUPPLIER_ACCESS]. Data involved: [DATA]. Contract owner: [OWNER]. List the clauses and operational controls to confirm: scope of access, least privilege, named individuals, sign-in requirements, logging, subcontractors, breach notification time frames, return or deletion of data, audit rights, insurance, and offboarding. For each item add why it matters and a sample question to the supplier. Provide a risk tiering table that determines how much due diligence is needed. Mark all legal and contractual language as needing review by counsel and mark jurisdiction-dependent points [VERIFY] for [JURISDICTION]. Do not draft contract clauses. Add a short section on onboarding the supplier safely: a kickoff call agenda, a request for their named contacts, and a test of access with a non-sensitive record first. Provide a table of review dates and triggers that require re-assessment, such as a change of subcontractor or a reported breach at the supplier. Treat this as blue-team work. Skip exploit details and attacker playbooks, and focus on controls, evidence and fixes I can verify.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.